security: load Creator secrets from files

2026-08-16 17:57:32 +03:00
parent e9594306e5
commit 03dde8c196
7 changed files with 190 additions and 7 deletions
@@ -42,15 +42,17 @@ services:
      POSTGRES_PASSWORD: ${SITUATION_DB_PASSWORD}
      IDENTITY_POSTGRES_USER: identity_role
      IDENTITY_POSTGRES_PASSWORD: ${IDENTITY_DB_PASSWORD}
-      CREATOR_BOOTSTRAP_TOKEN: ${CREATOR_BOOTSTRAP_TOKEN}
-      CREATOR_SESSION_SIGNING_KEY: ${CREATOR_SESSION_SIGNING_KEY}
+      CREATOR_BOOTSTRAP_TOKEN_FILE: /run/secrets/creator_bootstrap_token
+      CREATOR_SESSION_SIGNING_KEY_FILE: /run/secrets/creator_session_signing_key
      CREATOR_USERNAME: ${CREATOR_USERNAME}
-      CREATOR_PASSWORD: ${CREATOR_PASSWORD}
+      CREATOR_PASSWORD_FILE: /run/secrets/creator_password
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
      CAPABILITY_POSTGRES_USER: capability_role
      CAPABILITY_POSTGRES_PASSWORD: ${CAPABILITY_DB_PASSWORD}
    depends_on: { postgres: { condition: service_healthy } }
+    volumes:
+      - assistant_core_secrets:/run/secrets:ro

  continuity-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: continuity-runtime } }
@@ -107,3 +109,5 @@ services:
 volumes:
  assistant_pg:
  assistant_nats:
+  assistant_core_secrets:
+    external: true